Welcome to my blog on all things SharePoint. I have a range of articles that will interest you if you've made it as far as visiting my blog. I was awarded as an SharePoint MVP by Microsoft in July 2010. I currently live in New York and am an Enterprise Architect at AvePoint Inc.. I co founded www.NothingButSharePoint.com with Mark Miller in 2010.

MVP AwardJeremy Thake Profile Photo

Whitepapers

NBSP

Check out my articles on NothingButSharePoint.com

Solution Development in SharePoint 2007

This series was inspired by the chatter amongst SharePoint blogs on the best ways to approach customisations in SharePoint using Solutions.

Part 1 - Part 2 - Part 3 - Part 4 - Part 5 - Part 6 - Part 7 - Part 8

Leveraging the SharePoint Platform

This series was inspired by a discussion had with Andrew Coates at a Perth SharePoint User Group meeting. This then turned into a 6 part series on Arno Nell's SharePointMagazine.net web site.

Initial post - Part 1 - Part 2 - Part 3 - Part 4 - Part 5 - Part 6

Webcasts

I have recorded various web casts that I present at User Groups or just on a specific topic by request:
How ASP.NET Developers can leverage SharePoint webcast
SPSource Webcast: Reverse engineer Lists to ListTemplates and much more
SharePoint Development with Unit Testing webcast
Perth SharePoint UG Web Cast on approaches to deploying artefacts (SPSource)
More...


Podcasts

I have been interviewed about Leveraging the SharePoint Platform by the SharePoint Pod Show: listen here .

RSS Feed Feed your read!

Archives

November 2012 (6)
October 2012 (8)
September 2012 (4)
August 2012 (7)
July 2012 (13)
June 2012 (4)
March 2012 (1)
February 2012 (1)
January 2012 (5)
September 2011 (2)
August 2011 (1)
July 2011 (3)
June 2011 (7)
May 2011 (3)
April 2011 (3)
March 2011 (3)
February 2011 (2)
January 2011 (1)
December 2010 (4)
September 2010 (4)
July 2010 (5)
June 2010 (4)
May 2010 (6)
April 2010 (7)
March 2010 (5)
February 2010 (7)
January 2010 (3)
December 2009 (1)
November 2009 (6)
October 2009 (9)
September 2009 (7)
August 2009 (6)
July 2009 (13)
June 2009 (4)
May 2009 (12)
April 2009 (4)
March 2009 (4)
February 2009 (13)
January 2009 (4)
December 2008 (4)
November 2008 (11)
October 2008 (16)
September 2008 (4)
August 2008 (5)
July 2008 (4)
June 2008 (8)
May 2008 (5)
April 2008 (9)
March 2008 (5)
February 2008 (6)
January 2008 (1)
November 2007 (11)
October 2007 (8)
September 2007 (24)
August 2007 (5)
July 2007 (2)
May 2007 (1)
April 2007 (1)
March 2007 (1)
February 2007 (3)
January 2007 (4)
November 2006 (7)
October 2006 (7)
September 2006 (18)
August 2006 (14)
June 2006 (3)
May 2006 (8)
April 2006 (4)
March 2006 (38)
February 2006 (30)
January 2006 (2)
December 2005 (3)
November 2005 (28)
May 2005 (1)
April 2005 (5)
March 2005 (1)
November 2004 (1)
August 2004 (11)
July 2004 (1)
Failed to render control: An error occurred during a call to extension function 'createMonthUrl'. See InnerException for a complete description of the error.

Links

Tag Cloud

Ajax, Apple, DotNetNuke, Enterprise Content Management, Error Resolution, Gadgets, General, Governance, Microsoft .Net Development, Mobile, SharePoint, Sharepoint Business Forms, Sharepoint Business Intelligence, Sharepoint Collaboration, SharePoint Development, Sharepoint Enterprise Content Management, Sharepoint Enterprise Search, Sharepoint Portal, US Migration, Web 2.0, Workflow

SharePoint 2010 with Live ID   

Tags:
Technorati Tags:

I got Live ID running in Production with SharePoint 2010 after getting approval from Microsoft. This is for the new SharePointDevWiki.com SharePoint 2010 Enterprise site hosted by fpWeb. It will also host EndUserSharePoint.com and SharePointJoel.com to cater for Developers, End Users and IT Pros. We're very excited about getting this launched for SPTechCon on 20th October. This project has been nearly a year in the making after tossing up the idea at SPC09 over a beer!

I had it working with LIVE ID INT, which is the Test authentication mechanism.

I ended up following Wictor's Visual Guide which has slightly different PowerShell and this worked. Following the TechNet article failed with the error:

"The trusted login provider did not supply a token accepted by this farm"

Just thought I'd blog it here. I believe this is to do with the fact that LiveID is currently returning incorrect SAML, but I'm no expert here on this subject.

To add to Wictor's steps, when doing it in prod. Make sure you create a Live ID .cer following Wictor's instructions but grab it from https://nexus.passport.com/federationmetadata2/2007-06/federationmetadata.xml not https://nexus.passport-int.com/federationmetadata2/2007-06/federationmetadata.xml (remove the "-INT"). You'll have to add these to the Certificates for local machine too, I deleted the INT certs as I did this as I did the INT work on production. I also rolled out the Trusted Identity Token Issuer by unticking the "Live ID INT" from the Web Application and then running Remove-SPTrustedIdentityTokenIssuer "Live ID INT". Then I could run the scripts below no probs and keep it clean.

HUGE CREDIT TO WICTOR WILEN for this!

Things I've found

So now that I have it working, I figured I'd raise some issues I've found. If any of this is incorrect please let me know and I'll update this.

The Sign In menu

The Sign In menu shows the PUID for the Live ID in use. You get User Profile for the user which is awesome! I made the "Name" property editable by Users so they can update this. That means wherever the User actually modifies things it'll show that rather than the PUID.

to

User Profile Page

Once the User has updated his User Profile the My Profile does change the PUID too. I also changed my profile pic (not linked to MSN pic).

Presence

You'll also notice that the presence icon is offline. Even though I'm logged into Messenger (honest guv!). I put my Messenger User Name into the SIP in my User Profile on the off chance and no dice there either.

No Email in User Profile

I also noticed it doesn't even pull through the e-mail. I suspect I might need to add some more Claim Type Mappings.

All or Nothing

As the TechNet article says, you need a site you can give "All Users" from LiveID Read access to. This can seem a bit daunting, don't worry the User Profile Sync won't go and crawl all of Live ID ;-) It only adds Users to User Profiles as they authenticate for first time.

I added my Live ID as Site Collection Administrator and it appears to resolve fine.

But when I log in with that Live ID I get L

Turns out you can explicitly add Users but you need to add them with their PUID and this is not their MSN (tried with actual user name and got access denied) L To get the PUID you need to get the User to log into this site https://accountservices.passport-int.net/?ru=https://accountservices.passport-int.net/Credentials.srf%3Fvv%3D750%26mkt%3DEN-US%26lc%3D1033&vv=750&mkt=EN-US&lc=1033&id=10 and then go to Credentials and then to View Your Unique ID.

Grouping and Role based

So the other thing I found was that if you have multiple Site Collections, you need to get smarter about adding users. In AD scenario you'd use AD Groups and add the AD Groups once with appropriate Permission Level. But no such thing as Groups in Live ID, so you have to add each User to all your Site Collections.

I haven't investigated User Profile Audiences yet, to see whether I can compile one that way, albeit can't add Permissions, but could Target content that way.

Scripts

The working script was (highlighted difference):

$realm = "urn:[blocked]:prod"

$certfile = "C:\SSL\liveidprod.cer"

$rootcert = Get-PfxCertificate $certfile

New-SPTrustedRootAuthority "Live ID Root Authority" -Certificate $rootcert

$emailclaim = New-SPClaimTypeMapping     -IncomingClaimType "http://schemas.xmlsoap.org/claims/EmailAddress"     -IncomingClaimTypeDisplayName "http://schemas.xmlsoap.org/claims/EmailAddress"     -SameAsIncoming

$upnclaim =  New-SPClaimTypeMapping     -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"     -IncomingClaimTypeDisplayName "UPN"     -LocalClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"

$authp = New-SPTrustedIdentityTokenIssuer -Name "LiveID"     -Description "LiveID" -Realm $realm -ImportTrustCertificate $certfile     -ClaimsMappings $emailclaim,$upnclaim -SignInUrl "https://login.live.com/login.srf"     -IdentifierClaim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"

 

The failing one (from technet) was:

$realm = "urn: [blocked]:prod"

$certloc = "C:\SSL\liveidprod.cer"

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certloc);

New-SPTrustedRootAuthority -Name "Live ID STS Signing Public Key" -Certificate $cert;

$map1 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/claims/EmailAddress" -IncomingClaimTypeDisplayName "http://schemas.xmlsoap.org/claims/EmailAddress" -SameAsIncoming;

$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" -IncomingClaimTypeDisplayName "UPN" -LocalClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn";

$apSAML = New-SPTrustedIdentityTokenIssuer -Name "LiveID" -Description "LiveID" -Realm $realm -ImportTrustCertificate $cert -ClaimsMappings $map1,$map2 -SignInUrl "https://login.live.com/login.srf" -IdentifierClaim "http://schemas.xmlsoap.org/claims/EmailAddress";

 

 
Posted by  Jeremy Thake  on  9/22/2010
0  Comments  |  Trackback Url  | 0  Links to this post | Bookmark this post with:        
 

Links to this post

Comments

blog comments powered by Disqus